Journalist Sues FCC For Hiding Details About Its Alleged, Phantom DDOS Attack

from the calling-your-bluff dept

You might recall that when John Oliver did his latest piece on net neutrality, the FCC's comment system ground to a halt under the load of viewers pissed to realize that the FCC is trying to kill popular consumer protections protecting them from buffoonery by the likes of Comcast. But the FCC then did something odd: it claimed that a DDOS attack, not HBO's hit show, resulted in the website's issues. A statement issued by the FCC proclaimed that extensive "analysis" by the FCC had led the agency to conclude that it had suffered the attack at roughly the same time Oliver's program had ended:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC."

The problem: security experts saw no evidence that claim was true in publicly available logs, and saw none of the usual indicators preceding such an attack. And the FCC ever since has been bizarrely cagey, refusing to provide any evidence whatsoever supporting its claim. The FCC was subsequently prodded by several Senators as to the nature of the attack, but the FCC still refused to share any real data, despite agency boss Ajit Pai repeatedly, breathlessly insisting he would be a stalwart defender of transparency at the agency.

And when Gizmodo recently filed a FOIA request for anything regarding the nature of the attack, the FCC first released seventeen pages of nonsense, before admitting it had no documented "analysis" proving an attack as previously claimed. When additional websites began to point out that the FCC's behavior here was a little odd, the agency sent out a strangely-punchy press release lambasting news outlets for being "irresponsible."

So what's really happening here? The unsubstantiated journalist guess du jour is that the FCC bizarrely made up a DDOS attack in a feeble attempt to downplay the "John Oliver effect" in the media. "We weren't inundated by millions of people angry that we're killing popular consumer protections solely to the benefit of Comcast," this narrative suggests, "we were unfairly attacked!" The fact that there never actually was a DDOS attack would go a long way toward explaining the Trump FCC's subsequent inability to provide any evidence supporting the claim, even under pressure from Congress.

Hoping to flesh this theory out a bit, journalist Kevin Collier last week filed a lawsuit against the FCC (pdf) not only demanding more data on the agency's supposed DDOS attack, but also urging the FCC to provide some insight on what it's doing to address the wave of bogus, bot-produced anti-net neutrality comments flooding the agency's website in recent months:

"Collier said his records request was prompted by the FCC’s “weird and cagey” inclination to obscure details about the incident. “The fact that they gave Gizmodo such a runaround in its own request for internal ‘analysis’ of the attack just goes to show this,” he said. “I want to know the full story.” Sen. Ron Wyden, Democrat of Oregon, told Gizmodo last week the FCC’s actions raised “legitimate questions about whether the agency is being truthful when it claims a DDoS attack knocked its commenting system offline.”

Again, the refusal to address fraudulent anti-net neutrality comments being made at the FCC website (like the one made in my name), combined with the FCC's bizarre, phantom DDOS attack, has many believing the FCC is actively engaged in an intentional, amateurish attempt to downplay the massive backlash to their assault on net neutrality. And while it's entirely possible the FCC is just being non-transparent and generically stupid here, if it can be proved the agency actively lied about a DDOS attack then covered it up simply to downplay the immense unpopularity of its policies, the inevitable lawsuits against the agency in the wake of its final vote to kill the rules could get very interesting.

Filed Under: ddos, fcc, foia, kevin collier, public records

Over 190 Engineers & Tech Experts Tell The FCC It's Dead Wrong On Net Neutrality

from the that's-not-how-any-of-this-works dept

There's now 11 million comments on the FCC's plan to kill net neutrality, a record for the agency and a significantly higher output than the 4 million comments the FCC received when crafting the current rules. And while many of these comments are fraudulent bot-crafted support for the FCC's plan, the limited analysis we've seen so far suggests the vast majority of those organizations, companies and individuals prefer keeping the existing rules intact. And most people generally understand that removing regulatory oversight in the absence of organic market competition doesn't end well for anybody not-named Comcast.

One of the more notable recent filings (pdf) from this tidal wave of opposition comes from a collection of engineers, technologists, professors, current and former IETF and ICANN staffers, and numerous network architects and system engineers. Collectively, these experts argue that the FCC is not only making a mistake in killing net neutrality protections, it doesn't appear to understand how the internet actually works:

"Based on certain questions the FCC asks in the Notice of Proposed Rulemaking (NPRM), we are concerned that the FCC (or at least Chairman Pai and the authors of the NPRM) appears to lack a fundamental understanding of what the Internet's technology promises to provide, how the Internet actually works, which entities in the Internet ecosystem provide which services, and what the similarities and differences are between the Internet and other telecommunications systems the FCC regulates as telecommunications services.

This shouldn't be particularly surprising to you if you've watched FCC boss Ajit Pai wage a facts-optional assault on net neutrality, ranging from claims that the rules actively encouraged dictators in Iran and North Korea, to claims that ISPs are utterly innocent of anti-competitive behavior, but Netflix was violating net neutrality simply by running a content delivery network (CDN).

But the engineers single out numerous technical mistakes in the FCC's Notice for Proposed Rulemaking (NPRM), including incorrect assessments and conflation of the differences between ISPs and edge providers (Netflix, content companies), incorrect claims in the NPRM about how the transition from IPv4 to IPv6 functions, how firewalls work, and more. But the engineers and architects also warn, as countless others have before them, that not having meaningful rules in place will result in an "balkanized" internet that will be nothing like the one that drove decades of innovation:

"If ISPs could engage in this sort of blocking, throttling, and interference (which would no doubt occur in the absence of the light-touch, bright-line rules in the Open Internet Order), it would transform the Internet from a permission-less environment (in which anyone can develop a new app or protocol and deploy it confident that the Internet treats all traffic equally) into one in which developers would first need to seek approval from or pay fees to ISPs before deploying their latest groundbreaking technology. Developers and engineers would no longer be able to depend on the core assumption that the Internet will treat all data equally. The sort of rapid innovation the Internet has fueled for the past two decades would come to a sudden and disastrous halt.

Well, not that sudden. It seems likely that if the rules are killed, large ISPs like Comcast will try to remain on their best behavior for a short while to give the impression that axing the rules was a good idea. But with no meaningful regulatory oversight (keep in mind the goal here isn't just killing net neutrality, but nearly all oversight of ISPs), and no meaningful competition, they're simply not going to be able to help themselves. If the ability to act anti-competitively without repercussion is presented on a golden platter, they will take full advantage in their unyielding quest for improved quarterly earnings.

Of course this isn't the first time Ajit Pai and the FCC have been informed that they're wrong on this subject, and are gutting meaningful, popular and important consumer protections solely to the benefit of a handful of massive (and growing) telecom and media conglomerates. They just don't care. And while Pai and pals will still likely ignore this cacophony of opposition and vote to kill the rules anyway, with all of the recent examples of shady behavior at the agency on this subject, you'd like to think that something vaguely resembling accountability will wander in their direction... eventually.

Filed Under: experts, fcc, net neutrality, open internet, technologists

Senator Doesn't Buy FCC Justification For Killing Popular Net Neutrality Protections

from the repetition-forges-reality dept

So we've noted for years now how incumbent ISPs love to breathlessly insist that net neutrality protections "stifled broadband industry investment," despite the fact that publicly-available SEC filings, earnings reports, and the ISPs' own public statements on this subject have repeatedly proven this claim false. Traditionally, large ISPs like AT&T, Verizon, Comcast and Charter have employed industry-friendly economists to massage and cherry pick the data until it looks like a slowdown occurred. But every few months or so a journalist will painstakingly document how this slowdown claim is complete and total bullshit.

But this being the broadband industry, and lobbyists being lobbyists, the repeated debunking of their claims never seems to matter. In large part because they know that if they repeat this claim often enough, repetition will forge reality in the minds of people who don't know any better. That's why, several times a week for years, you'll see either editorials like this one by Montana State Senator Doug Kary or claims from organizations that pretend not to take money from the telecom industry, insisting that net neutrality rained all over their investment parade.

Ajit Pai once again trotted out this bogus claim during a hearing last week before the Senate Commerce Committee, a move that appeared to annoy Senator Ed Markey:

"Markey asked Pai what problem he is trying to fix by repealing net neutrality rules. Pai responded, "One of the concerns we have raised is these regulations might be dampening infrastructure investment."

"They might be, but there's no evidence of it," Markey fired back.

Pai continued, saying, "There has been evidence raised, and that is part of the reason why we are testing this proposition... we wanted to test this proposition in an open and public process."

Pai continues to pretend that he has an open mind and is "just testing stuff out," and not grotesquely dismantling popular consumer protections to the sole benefit of a handful of telecom and media conglomerates. And again, we appear to be stuck in a game of existential patty cake, where people pushing an agenda friendly to these duopolists hope repetition forges reality. Even though major ISP executives have made numerous public statements acknowledging this is all a bluff. Wyden was also quick to highlight these ISPs have never once informed investors of this apparent problem, as required by law:

"Publicly traded companies are required by law to provide investors accurate financial information, including reporting any risks or financial burdens. However, I have found no publicly traded ISP that has reported to its investors by law that Title II has negatively impacted investment in their networks. Many, in fact, have increased deployment and investment."

Wyden also was quickly to highlight that absent this bogus claim about sagging investment, there's really no sensible justification for killing net neutrality rules:

"I feel that the evidence [to repeal the rules] right now is not there and if it was, the broadband companies themselves would have in fact been providing that evidence to their investors in their filings, and they have not done so. Anecdotal evidence is not evidence. There is no factual basis for that change [proposed by the FCC]."

We all know (or should know by now) that Comcast, AT&T, Verizon and Charter want the rules dead simply so they can make more money. They know that with neither organic market competition nor functional regulatory oversight they'll have a green light to abuse this lack of competition in a rotating array of obnoxious and creative new ways. Of course they can't just admit this or they'd be laughed out of town, so we get to instead engage in this endless, idiotic game of "is not, is too," while they pretend removing oversight of some of the most anti-competitive companies in America is somehow economically essential.

Filed Under: ajit pai, ed markey, fcc, investment, net neutrality, ron wyden, title ii

Senator Wyden Argues FCC Is Either Incompetent Or Lying About Alleged DDoS Attack

from the derailing-the-John-Oliver-effect dept

Last week we noted how the FCC was acting incredibly suspicious in regards to its May claim that a DDOS attack, not annoyed John Oliver viewers, brought down the agency's website shortly after Oliver's latest rant on net neutrality. Despite pressure from journalists and several Senators, the FCC is simply refusing to release any data providing the existence of the attack, resulting in many media outlets not so subtly implying that the agency was lying:

"The FCC’s refusal to produce records of any true relevance reflects pressure from the agency’s upper echelon to limit the disclosure of information about the incident to a handful of carefully crafted public statements...It would be hard for a government agency to do more to give off the impression that it was engaged in a cover up. That’s troubling given the rise of questions over the FCC’s integrity.

As we noted last week, there are really only two options here. One, the FCC was attacked coincidentally at the same time John Oliver's program aired, it just failed to do any meaningful written analysis of the attack, and has zero interest in being transparent about it. Two, the FCC made up the attack completely to try to deflate all the talk about the "John Oliver effect" in the press, a misguided continuation of the agency's clear desire to downplay the massive public opposition to Pai's plan to kill net neutrality.

Based on the FCC's other recent behaviors in regards to ignoring comment fraud to this same purpose, it's fairly obvious the latter is a very real possibility. But with the FCC refusing to comply to FOIA requests, it's going to take some notable outside pressure to get to the truth. That's not going to be easy given that despite broad bipartisan support for the rules, ISPs have successfully convinced the public this is a partisan issue, which helps them stall meaningful discourse by bogging the entire process down in thinking-optional partisan patty cake.

Under the din of this dysfunction, Senator Ron Wyden was quick to highlight at the hearing that the FCC doesn't look particularly good here regardless of your political leaning:

"Senator Ron Wyden...stated in an email to Gizmodo that the agency’s response to Gizmodo’s FOIA request raised "legitimate questions about whether the agency is being truthful when it claims a DDoS attack knocked its commenting system offline."

The Oregon senator said it was critical that the agency produce evidence of the attack, if only so independent experts could verify and learn something from it. He continued: "If the FCC did suffer a DDoS attack and yet created no written materials about it, that would be deeply irresponsible and cast doubt on how the FCC could possibly prevent future attacks. On the other hand, if FCC is playing word games to avoid responding to FOIA requests, it would clearly violate Chairman Ajit Pai’s pledge to increase transparency at the FCC."

The FCC's contention is that for fifteen hours after the attack, nobody sent an e-mail, wrote a memo, or documented this supposed attack in any fashion. And again, this lack of transparency about any of this is in stark contrast to FCC boss Ajit Pai's repeated, breathless claims that he was going to bring a new wave of transparency to the agency. This lack of transparency will become increasingly stark as the agency continues to gut popular, meaningful consumer protections -- leaving the only thing standing between you and your carrier's bullshit an unelected bureaucrat that believes anti-competitive behavior in the telecom sector isn't a real problem.

Filed Under: ajit pai, ddos, fcc, john oliver, lies, ron wyden

$89 Billion AT&T, Time Warner Merger Approval Looking Likely Despite Trump Pledge To Block Deal

from the merge-ALL-the-things dept

Needless to say, consumer advocates and smaller competitors aren't too keen on AT&T's $89 billion plan to acquire Time Warner. They argue that AT&T's long history of unethical behavior, empty promises, and anti-competitive shenanigans make it extremely likely the company will use its greater size and leverage to ill effect. They worry that AT&T will make it harder for competitors to license content necessary to compete with AT&T's DirecTV Now streaming service, and arbitrary usage caps and other tricks like zero rating to similarly put competitors at a disadvantage.

Traditionally, these kinds of vertical integration deals aren't blocked because it's harder to clearly prove potential antitrust harm, even if AT&T has a thirty-year documented history of all manner of fraudulent behavior. On the campaign trail, Trump repeatedly promised that this was a deal his administration simply would not allow, given the "concentration of power" the deal would deliver:

"In an example of the power structure I’m fighting, AT&T is buying Time Warner and thus CNN -- a deal we will not approve in my administration because it’s too much concentration of power in the hands of too few.

Trump, of course, said a lot of things on the campaign trail, including promising to break up Comcast's already-completed 2011 acquisition of NBC, something Trump couldn't have done even if he wanted to. And while some thought that Trump's disdain for Time Warner-owned CNN would throw a wrench in the deal works, there's no indication that's going to happen. AT&T has already streamlined its chances for the deal by selling any assets that would have triggered an FCC review, and Trump subsequently appointed a DOJ antitrust boss on record stating he has no problem with the deal.

The fact that Trump's FCC has become a rubber stamp for every shitty idea coming out of AT&T's, Verizon's and Comcsast's collective heads should also likely clue people into which direction deal approval was leaning.

So not too surprisingly, media reports on the progress of the merger talks indicate AT&T's conversations with antitrust officials have shifted from whether the deal will be approved to finalizing what, if any conditions will be affixed to the deal:

"The early-stage discussions suggest that government lawyers have nearly finished their months-long look at how AT&T, the biggest pay-TV distributor, would reshape the media landscape with its bid for the owner of CNN and HBO -- and shows that the sides have moved on to talking about how they can make the merger work without harming rivals."

More accurately, they've moved on to talking about how they can make it appear that the merger could work without harming rivals, since, as we've long documented, the conditions affixed to these kinds of deals are traditionally only theatrical in nature. More often than not, the conditions are proposed by these telecom companies themselves, often requiring that companies do something they'd already planned to do anyway. In AT&T's case, it usually involves fudging their existing broadband deployment numbers, then promising a new broadband expansion that may or may not actually materialize.

We've documented how AT&T in particular is a long-standing professional at making all manner of bullshit promises if their mergers get approved, with regulators never really learning much of anything with hindsight. With Trump being no stranger to flimsy telecom promises of his own (his promise to block this deal being example A), the merger's going to create a wonderful opportunity for bullshit synergies the likes of which we may never see again.

Filed Under: antitrust, competition, doj, donald trump, fcc, merger
Companies: at&t, time warner

FCC Won't Release Data To Support Its Claim A DDOS Attack, Not John Oliver, Brought Down The Agency's Website

from the not-so-transparent-after-all dept

You might recall that when HBO comedian John Oliver originally addressed net neutrality on his show in 2014, the FCC website crashed under the load of concerned consumers eager to support the creation of real net neutrality rules. When Oliver revisited the topic last May to discuss FCC boss Ajit Pai's myopic plan to kill those same rules, the FCC website crashed under the load a second time. Both instances did a fantastic job highlighting how satire often tops traditional journalism in driving interest toward what can often be rather wonky tech policy issues.

But then something weird happened. In the midst of all the attention Oliver was receiving for his segment, the FCC issued a statement (pdf) by FCC Chief Information Officer David Bray, claiming that comprehensive FCC "analysis" indicated that it was a malicious DDoS attack, not angry net neutrality supporters, that brought the agency's website to its knees:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC."

But this claim that a DDoS disabled the FCC website at coincidentally the exact same time Oliver's segment was airing raised a few eyebrows among security experts, who noted they saw none of the usual online indicators pointing to a DDoS attack, nor any evidence of an attack via publicly-available logs. Security analysts noted the FCC provided no evidence to support their claim of an attack, and the agency has consistently and repeatedly refused to offer any additional hard detail, despite being prodded by several Senators on the subject.

Hoping to glean a little more information, Gizmodo recently filed a FOIA request asking for server logs or documents offering more insight into this supposed attack. What they found is that the FCC never conducted said "analysis" of the attack in the first place:

"The FCC now tells Gizmodo, however, that it holds no records of such an analysis ever being performed on its public comment system; the agency claims that while its IT staff observed a cyberattack taking place, those observations “did not result in written documentation."

Gizmodo's FOIA request asked for "all communications between employees in the offices of Chairman Ajit Pai and Commissioner Michael O’Rielly" concerning the alleged cyberattack, as well as copies of "any records related to the FCC 'analysis' (cited in Dr. Bray’s statement) that concluded a DDoS attack had taken place." What they got instead was 17 pages of heavy redactions and nonsense (including several user complaints about what Pai's been up to) and a rotating crop of excuses for why the FCC couldn't be more transparent about the alleged attack:

"The agency cited a variety of reasons for why it was refusing to release 209 documents related to the purported DDoS attack. Some of the records, it says, contain “trade secrets and commercial or financial information” which it deems “privileged or confidential,” citing the Trade Secrets Act. Other documents were withheld in an effort to “prevent injury to the quality of agency decisions,” citing a FOIA exemption that typically protects attorney-client communications but also extends to documents that reflect “advisory opinions, recommendations and deliberations” as part of the government’s decision-making processes."

It didn't take long for news outlets to highlight the FCC's refusal to be clear about what happened, prompting the agency to e-mail this press release to reporters, deriding said reports as "completely irresponsible":

"Media reports claiming that the FCC lacks written documentation of its analysis of the May 7-8 non-traditional DDoS attack that took place against our electronic comment filing system are categorically false. In its FOIA request, Gizmodo requested records related to the FCC analysis cited in Dr. David Bray’s May 8 public statement about this attack. Given that the Commission’s IT professionals were in the midst of addressing the attack on May 8, that analysis was not reduced to writing. However, subsequent analysis, once the incident had concluded, was put in writing. Indeed, analysis was made public in response to a request from Capitol Hill.

“Moreover, the FCC has never stated that it lacks any documentation of this DDoS attack itself. And news reports claiming that the Commission has said this are without any basis and completely irresponsible. In fact, we have voluminous documentation of this attack in the form of logs collected by our commercial cloud partners."

But while the FCC's statement proclaims the agency has oodles of documentation detailing the supposed DDoS (it just doesn't want to reveal it), that's the precise opposite of what the agency is telling reporters that have filed FOIA requests to get a hold of it:

So it seems like there's two options here. One is that there really was some kind of non-traditional DDoS attack, but the agency failed to conduct a detailed written analysis of what caused it, and despite boss Ajit Pai's breathless dedication to transparency, has zero interest in being up front about it.

The other possibility is the entire attack narrative was poorly-constructed bullshit, feebly designed to try and deflate the "John Oliver effect" in the media and downplay the volume of consumers pissed off about what Ajit Pai is up to. And now that Senators and reporters are pushing harder for actual evidence, the FCC is having to engage in some comical tap dancing to obfuscate the fact it made up a DDOS attack as a lame (and ineffective) PR ploy.

The former's certainly possible, but the latter's also in character. Either way, expect this and the agency's willful disregard of comment proceeding fraud to pop up in the inevitable lawsuits awaiting Ajit Pai when he rams through the final net neutrality killing vote later this year.

Filed Under: ajit pai, comments, ddos, fcc, john oliver, net neutrality